An increasing number of data security threats exist in the modern computerized society. These threats may include viruses or other malware that attacks the local computer of the end user, or sophisticated cyber attacks to gather data and other information from the cloud or server based infrastructure. This server based infrastructure includes real and virtual computing devices that are used to provide a variety of services to user computing systems, such as data storage, cloud processing, web sites and services, amongst other possible services. To protect applications and services, various antivirus, encryption, and firewall implementations may be used across an array of operating systems, such as Linux and Microsoft Windows.
Further, some computing environments may implement security information and event management (SIEM) systems and other security detection systems to provide real-time analysis of security alerts generated by network hardware and applications. In particular, SIEM systems allow for real-time monitoring, correlation of events, notifications, and console views for end users. Further, SIEM systems may provide storage logs capable of managing historical information about various security events within the network. Although SIEMs generate security alerts for devices within the network, administrators may be forced to translate each of these alerts into particular actions. Thus, time and resources that could be used on other tasks may be used in researching and determining an appropriate course of action to handle a security threat. Further, difficulties may arise when an administrator is unavailable or unable to respond to a security incident when the incident occurs.